Manual sessions

A manual session lets you publish from any machine, without a plugin, a device or a CI trust policy. You sign in to the web UI, prove a second factor, and copy a token. The token works for 15 minutes by default.

Create a session

1. Open the server in a browser and sign in.
2. Open the Publishing page.
3. Choose the repository. Press “New publish session”.
4. Enter a fresh TOTP code, or confirm with a passkey. A recovery code does not work here.
5. Copy the token. It starts with trs_.

You need a second factor on your account. Add one on the Security page first. See Accounts and 2FA. You also need the write permission on the repository.

The page shows ready-made snippets for the repository. Use the token as the password. Any user name works.

Use the token

curl (Maven)

curl -f -u publish:trs_TOKEN -T app-1.0.jar \
  https://repo.acme.com/maven/releases/com/acme/app/1.0/app-1.0.jar

curl (raw)

curl -f -u publish:trs_TOKEN -T file.tar.gz \
  https://repo.acme.com/raw/files/path/file.tar.gz

curl (Debian)

curl -u publish:trs_TOKEN -T app_1.0_amd64.deb \
  https://repo.acme.com/debian/apt/upload/stable/main

Maven

~/.m2/settings.xml

<server>
  <id>telesphorepo</id>
  <username>publish</username>
  <password>trs_TOKEN</password>
</server>

Gradle

build.gradle.kts

publishing {
    repositories {
        maven {
            url = uri("https://repo.acme.com/maven/releases")
            credentials {
                username = "publish"
                password = "trs_TOKEN"
            }
        }
    }
}

Debian indexes rebuild after the deb.debounce time. See Debian.

End a session early

The token ends itself after 15 minutes. To end it sooner, send a DELETE with the same token:

curl -f -X DELETE -u publish:trs_TOKEN https://repo.acme.com/api/publish/sessions/SESSION_ID

Your own sessions are at GET /api/publish/sessions. See HTTP API.

Gotchas

• Remove the token from settings.xml or build.gradle.kts after the publish. It expires soon, but it is still a working credential.
• A token works for one repository only.
• The time limit is publish.session_ttl. An admin can set it up to 1 hour.
• If the token expires during a long upload series, create a new session.
• Wrong second-factor codes count toward the rate limit. After too many, the server answers 429 with a Retry-After header.
• A read token or another publish session token cannot create a session.